Vulnerability · Published Apr 5, 2026 · Assigned by VulDB
CVE-2026-5548Tenda AC10 httpd fromSysToolChangePwd stack-based overflow
High 8.8
In plain English
A high-severity stack buffer overflow in AC10 from Tenda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 52.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Tenda AC10 16.03.10.10_multi_TDE01. Affected by this vulnerability is the function fromSysToolChangePwd of the file /bin/httpd. Performing a manipulation of the argument sys.userpass results in stack-based buffer overflow. The attack can be initiated remotely.
Affected products (as reported)
Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R
References
- VDB-355312 | Tenda AC10 httpd fromSysToolChangePwd stack-based overflow vdb-entry, technical-description
- VDB-355312 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #782297 | Tenda AC10 V4 US_AC10V4.0si_V16.03.10.10_multi_TDE01 Stack-based Buffer Overflow third-party-advisory
- https://github.com/somanyerrors/tenda-ac10v4-vulnerabilities/blob/main/findings/CRITICAL-04-stackoverflow-fromsystoolchangepwd.md related
- https://www.tenda.com.cn/ product